General
-
Target
file.exe
-
Size
352KB
-
Sample
230416-y8zjtsdf41
-
MD5
a7e92b6065a8b7859c2a5f2b6af7456d
-
SHA1
82e16ca74150f0c18c2b80985cc342e7b68d2b01
-
SHA256
719e4f0ff66bd18cd517da2f7620b292966225ee7e6185d64de444f2181d51ca
-
SHA512
2d7271d4ed01d5618c40d1a6f391521bb7bf4e75c7d3d8a815a186c00cf784f0e980042b1b2a0ed27c9e8708fb58f26883e5ea0405f5b2874ef86bb9859ac215
-
SSDEEP
3072:cny/XreDmKCOImk4sYpUCC1cFzMX2kMZtOBiYrsH6tzwPAW/A0VLn0sP9peUIQoY:yytK/I0GCyCtgPrsHTA4AQIsZYUSz2
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
352KB
-
MD5
a7e92b6065a8b7859c2a5f2b6af7456d
-
SHA1
82e16ca74150f0c18c2b80985cc342e7b68d2b01
-
SHA256
719e4f0ff66bd18cd517da2f7620b292966225ee7e6185d64de444f2181d51ca
-
SHA512
2d7271d4ed01d5618c40d1a6f391521bb7bf4e75c7d3d8a815a186c00cf784f0e980042b1b2a0ed27c9e8708fb58f26883e5ea0405f5b2874ef86bb9859ac215
-
SSDEEP
3072:cny/XreDmKCOImk4sYpUCC1cFzMX2kMZtOBiYrsH6tzwPAW/A0VLn0sP9peUIQoY:yytK/I0GCyCtgPrsHTA4AQIsZYUSz2
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-